Backup System, Relay Device, Information Terminal, and Backup Device

ABSTRACT

To allow a user to easily back up data without anxiety, the present invention provides a backup system that transfers data transmitted by an information terminal device to a backup device via at least one relay device that relays the data, the information terminal device comprising: a storing unit operable to store the data to be backed up; and a communication unit operable to transmit, to the relay device, the data and transfer condition information that indicates a condition to be satisfied by the relay device and relates to protection of the data, the relay device comprising: a device information storing unit operable to store device information relating to transfer destination devices; a receiving unit operable to receive the data and the transfer condition information; and a transfer control unit operable to select, from the transfer destination devices, a transfer destination device that satisfies the condition indicated by the received transfer condition information, and to control transfer of the received data in accordance with the selection, and the backup device comprising: a backup data receiving unit operable to receive the data transferred by the relay device; and a backup data storing unit operable to store the received data.

TECHNICAL FIELD

The present invention relates to backup of data stored in mobilecommunication devices, such as mobile phones.

BACKGROUND ART

In recent years, mobile communication devices such as mobile phones havebeen improved in their processing capacity and communication capacity.As a result of such improvements, mobile communication devices are nowcapable of performing a various types of processing and used for variouspurposes. For example, camera-equipped mobile phones can be used fortaking pictures of friends of users and landscapes while traveling, andsaving the pictures such that the users can view the pictures anytime.With camera-equipped mobile phones, it is also possible to exchange dataof saved still images and moving pictures among the users, using acommunications technology, such as infrared communication. The datasaved by the users themselves often reflects the users' personalconnections, users' preference, and so on. Therefore, such data isvaluable especially for the users concerned with the data.

However, as usually carried about by the users, mobile communicationdevices are vulnerable to unforeseen circumstances, such as loss due tousers' carelessness. If a user loses a mobile communication device, thisalso means that the user loses the data valuable for the user.

To prevent data from being lost in unforeseen circumstances, techniquesfor backing up data that is stored in a mobile communication device arewidely used.

For example, Patent Documents 1 and 2 listed below disclose a techniquefor transferring data stored in a mobile phone to a server setup in homeor the like, when charging the mobile phone.

Also, Patent Document 3 discloses a technique for performingtransmission and reception of data between a mobile phone and a backupcenter via telephone lines, in order to back up text-based data such asaddress data whose data size is smaller than still image data and movingpicture data.

Patent Document 1: Japanese Laid-open patent Application Publication No.2003-347988; Patent Document 2: Japanese Laid-open patent ApplicationPublication No. 2002-33798; Patent Document 3: Japanese Laid-open patentApplication Publication No. 2000-78070. DISCLOSURE OF THE INVENTIONProblem to be Solved by the Invention

However, the technique disclosed by Patent Documents 1 and 2 can notstart the data backup immediately if the user can not charge the mobilecommunication device immediately, because the backup is triggered by thecharging. Especially while the user is on a trip, the risk of the dataloss increases as the period for which the user can not charge themobile communication device increases.

Regarding the technique disclosed by Patent Document 3, the backup canbe completed without any serious problem if the data to be backed up iscomparatively small. However, if the only communications means availablefor the backup is telephone lines and accordingly it is difficult totransfer comparatively large data such as still images and movingpictures in a short period, unignorable problems might occur. Forexample, since it takes long time to transfer data via telephone lines,an error might occur halfway through the backup due to weak signalstrength. Moreover, if the telephone line is of a pay-as-you-go type,the cost can be very high. Therefore, in view of practical use, it isdifficult to execute the backup.

Alternatively, it is possible to use network connection services, suchas a public wireless LAN network, to backup data. Such services realizecomparatively high-speed transfer of data to backup devices.

However, in the network, the pathway to be used for transferring data isusually determined by a router or the like. Therefore, it is difficultfor the users to predict which pathway is to be used in transfer of thedata.

This means that it is difficult for the users to predict to whom thedata will be exposed. Therefore, the users feel insecure abouttransmitting data including personal information via a network.Especially, regarding mobile communication devices demanded to besmaller, it is sometimes difficult to take measures to protect the databy encryption or the like, because of functional constraint of themobile communication devices. In such a case, the users feel veryinsecure.

The object of the present invention is to provide a backup system and abackup method that allow a user to easily back up data without anxietyeven if a mobile communication device such as a mobile phone can notdirectly communicate with a backup device or a transmission speed of acommunication line between the communication device and the backupdevice is not high enough to transmit large data.

Means for Solving the Problems

To solve the above-described problems, the present invention provides abackup system that transfers data transmitted by an information terminaldevice to a backup device via at least one relay device that relays thedata, the information terminal device comprising: a storing unitoperable to store the data to be backed up; and a communication unitoperable to transmit, to the relay device, the data and transfercondition information that indicates a condition to be satisfied by therelay device and relates to protection of the data, the relay devicecomprising: a device information storing unit operable to store deviceinformation relating to transfer destination devices; a receiving unitoperable to receive the data and the transfer condition information; anda transfer control unit operable to select, from the transferdestination devices, a transfer destination device that satisfies thecondition indicated by the received transfer condition information, andto control transfer of the received data in accordance with theselection, and the backup device comprising: a backup data receivingunit operable to receive the data transferred by the relay device; and abackup data storing unit operable to store the received data.

The present invention also provides a relay device that relays datatransmitted by an information terminal device to a backup device,comprising: a device information storing unit that stores deviceinformation relating to devices as candidates for a transfer destinationof the data; a receiving unit operable to receive the data and transfercondition information that indicates a condition to be satisfied by therelay device and relates to protection of the data; and a transfercontrol unit operable to select, from the candidates, a device thatsatisfies the condition indicated by the received transfer conditioninformation, and to control transfer of the received data in accordancewith the selection.

The present invention also provides an information terminal device thattransmits data to a backup device via at least one relay device thatrelays the data, the information terminal device comprising: a storingunit operable to store the data to be backed up; and a communicationunit operable to transmit, to the relay device, the data and transfercondition information that indicates a condition to be satisfied by therelay device and relates to protection of the data.

ADVANTAGEOUS EFFECT OF THE PRESENT INVENTION

With the stated structure, even if the information terminal device cannot directly communicate with the backup device, the user of theinformation terminal device can back up the data by transmitting thedata and the transfer condition information to the relay device.Therefore, the user does not lose the data even if it becomes impossibleto use the information terminal device due to lost of the informationterminal device, for example.

Also, the relay device with the stated structure can receive thetransfer condition information with the transfer data, select anotherrelay device as a transfer destination device based on the transfercondition information, and transmits the transfer data to the transferdestination device. Therefore, it is possible to perform the transferwith protecting the transfer data. In other words, the user can transferthe data via a transfer pathway limited by the user to protect the data.

Accordingly, the user can reduce the risk of an invasion of privacy, andbackup the data without anxiety.

Here, the condition indicated by the transfer condition information maybe that a device is not in a blacklist showing devices not permitted tobe the transfer destination, and the transfer control unit may select,from the candidates, a device that is not in the blacklist.

With the stated structure, the user can prevent the data to be backed upfrom being relayed by an undesired relay device.

The device information may include a reliability level for each of thecandidates, the transfer condition information may indicate a thresholdvalue of the reliability level to be satisfied by the transferdestination, and the transfer control unit may select, from thecandidates, a device that satisfies the threshold value.

By performing the backup via the relay device having the statedstructure, it is possible to limit the transfer pathway using only thereliability threshold value, instead of determining, for each transferdestination device, whether to permit the device to transfer the data.Therefore, this realizes the protection of the transfer data easily.Also, the user can flexibly set the level of the limitation of thetransfer pathway depending on the data content by changing the thresholdvalue depending on the data content.

For example, when transmitting data desired to be kept in strictconfidence, such as private picture data, it is possible to strictlylimit the pathway such that the data is relayed by only a highlyreliable device. On the other hand, when transmitting data that can notbe a disadvantage for the user even if it is exposed to the public, suchas landscape picture data, it is possible to permit a relay device withlow reliability to perform the transfer.

The transfer control unit may further include a conversion processingsubunit operable to perform predetermined conversion processing on thedata, and may transfer the data after performing the predeterminedconversion processing on the data.

With the stated structure, it is possible to perform the transfer of thedata with strict protection.

The transfer control unit may control the transfer such that the dataconverted by the conversion processing subunit is transferred to adevice not satisfying the condition indicated by the transfer conditioninformation.

With the stated structure, the predetermined conversion processing isperformed only in the case where the data is transmitted to the devicenot satisfying the condition indicated by the transfer conditioninformation. Accordingly, while protecting the data, it is possible toeffectively process the data in accordance with the reliability level ofthe transfer destination device.

The predetermined conversion processing performed by the conversionprocessing subunit may be insertion of an identifier of the relaydevice, as a digital watermark, into the data.

With the stated structure, even if the data is used by an unauthorizeduser, it is possible to track the unauthorized user, using thewatermark. As a result, it becomes easy to manage such an unauthorizeduse of the data.

Meanwhile, if the transfer data is kept by the relay device for a longtime, there is a risk of leakage of the data due to problems with therelay device. Also, if the user can not know when the backup will becompleted, the user feels insecure because he can not confirm that thebackup is surely executed. Therefore, the time when the backup will becompleted is of high interest to the user.

For this reason, the receiving unit may further receive at least one ofa transfer deadline, a data keep deadline and a deletion deadline, ifthe receiving unit receives the transfer deadline, the relay device maycontrol the transfer, using the transfer control unit, such that thedata is received by the backup device before the transfer deadline, ifthe receiving unit receives the data keeping deadline, the relay devicemay keep the data until the keeping deadline, and if the receiving unitreceives the deletion deadline, the transfer control unit may delete thedata at the deletion deadline.

With the stated structure, in view of protection of the data, it ispossible to reduce the risk the relay device keeping the data for a longtime. Also, the user can know when the backup will be completed at thelatest. Therefore, the user can perform the backup without anxiety.

The relay device may further comprise: an exchange informationtransmitting unit operable to create and transmit exchange informationindicating that the data received by the receiving unit is kept in therelay device; and a transfer request receiving unit operable to receive,from another device that has received the exchange information, arequest for transfer of the data corresponding to the exchangeinformation, wherein if the transfer request receiving unit receives thetransfer request, the transfer control unit may control the transfersuch that the data relating to the transfer request is transmitted tosaid another device. Moreover, a backup device that receives datatransmitted from an information terminal device via the above-describedrelay device may comprise: an exchange information transmitting unitoperable to receive the exchange information from another device; atransfer request transmitting unit operable to transmit a request fortransferring the data to the relay device that keeps the data; a backupdata receiving unit operable to receive the data relating to therequest; and a backup data storing unit operable to store the receiveddata.

Since the relay device having the stated structure controls transfer ofthe data on reception of a transfer request from another device such asthe backup device that has received the identifier information, thedevice that has received the identifier information can inquire of therelay device as to the data to be backed up.

Meanwhile, according to the method for the back up described above, thedata stored in the information terminal device is backed up by the aidof the relay device. In this method, the relay device keeps the datatransmitted by the information terminal device, and performs processingfor the relay operation, which means that the resource of the relaydevice is consumed for the backup. In other words the processingcapacity of the relay device is used for the backup of the data of theinformation terminal device in a one-sided manner.

For this reason, before transmitting the data, the communication unitmay transmit first transmission/reception condition information to arelay device, and receives second transmission/reception conditioninformation from the relay device, and the information terminal devicemay further comprise a judging unit operable to judge whether the firsttransmission/reception condition information and the secondtransmission/reception condition information are substantially the same,and if the judging unit judges affirmatively, the communication unit maytransmit the data to the relay device.

With the stated structure, the information terminal device exchanges thetransmission/reception condition information with the relay device, andjudges whether to transfer the data based on pieces of thetransmission/reception condition information received by the informationterminal device and the relay device respectively. Therefore, it ispossible to control the backup by mutual consent between the informationterminal device and the relay device.

The first transmission/reception condition information may be associatedwith transmission data that the information terminal device transmits,the second transmission/reception condition information may beassociated with reception data that the information terminal devicereceives from the relay device, if the judging unit judgesaffirmatively, the communication unit may transmit the transmission datato the relay device and receives the reception data from the relaydevice, and the storing unit may store the received reception data.

The information terminal device with the stated structure stores, whentransmitting the transfer data to be backed up, the data transmittedfrom the relay device. Therefore, it is possible to perform the backupin a fair manner, without one-sidedly using the processing capacity andthe resource of one of information terminal device and the relay device.

Each of the first transmission/reception condition information and thesecond transmission/reception condition information may include at leastone of a size of the data, a keeping deadline until which the relaydevice or the information terminal device keeps the data, a recordingmethod for recording the data in a recording medium and an incentive forkeeping the data.

With the stated structure it is possible to judge whether to transferthe data based on the combination of the plurality of conditions.Therefore, it is possible to set the permissible range to detail.

The incentive may include at least one of value information having acash value, relay device control information indicating a right to havethe relay device perform predetermined processing, and viewing rightinformation indicating a right to view a predetermined content.

With the stated structure, it is possible to obtain the predeterminedright not only by performing the mutual backup but also by keeping thebackup data transmitted from another device as party. Therefore, it ispossible to encourage the user of a device to keep data transmitted fromanother device.

The storing unit may further store relay device information relating torelay devices as candidates for a transfer destination of the data, andthe communication unit may select, from the candidates, a device thatsatisfies the condition indicated by the condition information, andtransmit the data and the transfer condition information in accordancewith the selection.

With the stated structure, it is possible to control the transfer of thedata in accordance with whether it is possible to protect the data.Therefore, the user of the information terminal device can perform thebackup without anxiety.

The present invention may be an integrated circuit used for aninformation terminal device that transmits data to a backup device viaat least one relay device that relays the data, the integrated circuitcomprising: a storing unit operable to store the data to be backed up;and a communication unit operable to transmit the data and transfercondition information that indicates a condition to be satisfied by therelay device and relates to protection of the data.

The present invention may also be a computer program for instructing aninformation terminal device that stores data to be backed up to transmitthe data to a backup device via at least one relay device that relaysthe data, the computer program comprising the step of transmitting thedata and transfer condition information that indicates a condition to besatisfied by the relay device and relates to protection of the data.

The present invention may also be a backup method for transferring datatransmitted by an information terminal device to a backup device via atleast one relay device that relays the data, the backup methodcomprising: the steps performed by the information terminal device ofstoring the data to be backed up, and transmitting, to the relay device,the data and transfer condition information that indicates a conditionto be satisfied by the relay device and relates to protection of thedata; the steps performed by the relay device of storing deviceinformation relating to devices as candidates for a transfer destinationof the data, receiving the data and transfer the condition information,and selecting, from the candidates, a device that satisfies thecondition indicated by the received transfer condition information, andcontrolling the transfer of the received data in accordance with theselection; and the steps performed by the backup device of receiving thedata transferred by the relay device; and storing the received data.

The present invention may also be a backup method for backing up datawith use of a first information terminal device and a second informationterminal device, the backup method comprising: a storing step of storingthe data to be backed up; and a communication step of transmitting thedata and transfer condition information that indicates a condition to besatisfied by the relay device and relates to protection of the data,wherein when performed by the first information terminal device, thecommunication step further transmits first transmission/receptioncondition information to the second information terminal device andreceives second transmission/reception condition information from thesecond information terminal device, before transmitting first data tothe second information terminal device, and when performed by the secondinformation terminal device, the communication step further transmitsthe second transmission/reception condition information to the firstinformation terminal device and receives the firsttransmission/reception condition information from the first informationterminal device, before transmitting the second data to the firstinformation terminal device, wherein the backup method further comprisesa judging step of judging whether the first transmission/receptioncondition information and the second transmission/reception conditioninformation are substantially the same, wherein when performed by thefirst information terminal device, the communication step furthertransmits the first data to the second information terminal device ifthe judging step judges affirmatively, and when performed by the secondinformation terminal device, the communication step further transmitsthe second data to the first information terminal device.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows an overall structure of a backup system 1000 according tothe first embodiment of the present invention;

FIG. 2 is a functional block diagram of a mobile phone 100;

FIG. 3 is a functional block diagram of a mobile phone 200;

FIG. 4 is a functional block diagram of a backup server 300;

FIG. 5 is a functional block diagram of a backup server 900;

FIG. 6 is a table 600 showing transfer condition information;

FIG. 7 is a table 700 showing reliability threshold values;

FIG. 8 is a flowchart showing operations performed by an informationterminal device;

FIG. 9 is a flowchart showing operations performed by a relay device;

FIG. 10 is a flowchart showing operations performed by a backup device;

FIG. 11 shows an overall structure of a backup system 2000 according tothe second embodiment of the present invention;

FIG. 12 is a functional block diagram of a mobile phone 210 according tothe second embodiment;

FIG. 13 shows exchange information 1300;

FIG. 14 is a flowchart showing operations performed by a relay deviceaccording to the second embodiment;

FIG. 15 is a functional block diagram of a mobile phone 500 having amutual backup function;

FIG. 16 shows tables showing transmission/reception conditioninformation; and

FIG. 17 is a flowchart showing operations of mutual backup performed byan information terminal device and another device.

EXPLANATION OF REFERENCES

-   100, 200, 201, 210, 211: MOBILE PHONE-   300, 301, 900: BACKUP SERVER-   11: IMAGE ACQUIRING UNIT-   12: STORING UNIT-   13: BACKUP IMAGE SELECTING UNIT-   14: TRANSFER CONDITION INFORMATION SETTING UNIT-   15: BACKUP INFORMATION GENERATING UNIT-   16: TRANSFER DESTINATION SELECTING UNIT-   17: TRANSFER DESTINATION AUTHENTICATING UNIT-   18: TRANSMITTING UNIT-   21: TRANSMISSION SOURCE AUTHENTICATING UNIT-   22: RECEIVING UNIT-   23: STORING UNIT-   24: CONTROL UNIT-   25: TRANSFER DESTINATION SELECTING UNIT-   26: TRANSFER DESTINATION AUTHENTICATING UNIT-   27: TRANSMITTING UNIT-   28: EXCHANGE INFORMATION CREATING UNIT-   31: TRANSMISSION SOURCE AUTHENTICATING UNIT-   32: RECEIVING UNIT-   33: STORING UNIT-   34: CONTROL UNIT-   35: TRANSMISSION SOURCE SELECTING UNIT-   36: TRANSMISSION SOURCE AUTHENTICATING UNIT-   37: TRANSMITTING UNIT-   51: TRANSMISSION SOURCE/DESTINATION SELECTING UNIT-   52: TRANSMISSION SOURCE/DESTINATION AUTHENTICATING UNIT-   54: TRANSMISSION/RECEPTION CONDITION CONTROL UNIT-   55: TRANSMISSION/RECEPTION CONDITION GENERATING UNIT-   91: TRANSMISSION SOURCE AUTHENTICATING UNIT-   92: RECEIVING UNIT-   93: DATA EXTRACTING UNIT-   94: STORING UNIT

BEST MODE FOR CARRYING OUT THE INVENTION First Embodiment

The following describes the first embodiment of a backup systemaccording to the present invention.

<Overview>

In the backup system according to the present invention, an informationterminal device transmits data stored therein and is to be backed up toa backup device via relay devices that relay the data. In the firstembodiment, it is assumed that the information terminal device is amobile phone. To back up the data stored in the mobile phone in thebackup device owned by the user of the mobile phone, another backupdevice owned by a user of another mobile phone relays the data. Notethat the data to be backed up is, for example, still images and movingpictures acquired by the mobile phone using a camera function thereof.The following describes the backup system in detail.

FIG. 1 shows an overall structure of the backup system 1000 according tothe first embodiment of the present invention.

As FIG. 1 shows, the backup system 1000 includes a mobile phone 100 asan information terminal device that transmits data to be backed up to abackup device, a mobile phone 200 as a relay device that relays thetransmitted data, a backup server 300, a mobile phone 201, a backupserver 301, and a backup server 900 as the backup device that backs upthe data of the mobile phone 100.

The mobile phone 100 and the mobile phone 200 are connected with eachother via a communication path 20. In the same manner, the mobile phone200 and the backup server 300 are connected with each other via acommunication path 30, and the backup server 300 and the backup server900 are connected with each other via a communication path 90. Also, themobile phone 100 and the mobile phone 201 are connected with each othervia a communication path 21, the mobile phone 201 and the backup server301 are connected with each other via a communication path 31, and thebackup server 301 and the backup server 900 are connected with eachother via a communication path 91.

The following is a situation assumed in the first embodiment where thebackup is performed. First of all, it is assumed that a user 1 as theuser of the mobile phone 100 connects, usually when he gets home, themobile phone 100 with the backup server 900 set up in his home toperform backup. The backup method used here is such as those disclosedin Patent Documents 1 and 2, i.e. transmitting backup data to the backupserver 900 when the mobile phone is connected with a battery charger.Note that it is also assumed that the backup server 900 is connectedwith an external network.

Here, if the user 1 is on a long-term trip with a user 2, and can notuse a high-speed network such as a broadband communication network tohave the mobile phone 100 connect with the backup server 900 set up inhis home, it is difficult to make backup using the backup server 900. Insuch a case, the user 1 transfers the data to be backed up to the mobilephone 200 owned by the user 2 accompanying the user 1, via thecommunication path 20.

The communication path 20 is, for example, a broadband ad-hocshort-range wireless network such as Bluetooth, a USB (Universal SerialBus) connection and a wireless LAN (Local Area Network), or a UWB (UltraWide Band), a PAN (Personal Area Network), a wired connection, or ahand-to-hand transfer of an external medium such as a recording medium.

In this way, by transferring backup data to the mobile phone 200, theuser 1 can protect the backup data against loss even in the case wherethe user 1 can not make backup using the backup server 900 and loses themobile phone 100.

If receiving the backup data of the mobile phone 100 by the mobile phone200, the user 2 connects the mobile phone 200 with the backup server 300owned by the user 2 when he gets home, to transmit the backup datareceived from the mobile phone 100 together with the backup data of themobile phone 200 itself to the backup server 300 via the communicationpath 30. The backup server 300 is connected with a network. The backupserver 300 transmits the backup data of the mobile phone 100 to thebackup server 900, which is connected to the network as well, via thecommunication path 90. The communication path 90 is, for example, abroadband communication network using fiber optics, and it is assumedthat the communication path 90 can transfer data at a comparativelyhigh-speed. The broadband communication network is a communicationschannel having a broad bandwidth. In recent years, carriers such as ISPs(Internet Services Providers) have been offering flat-rate pricing forinternet access services. Therefore, the cost of the data transmissionvia the communication path 90 is not a great burden for the user 2.

The backup server 900 receives and records the backup data of the mobilephone 100, which has been transmitted from the backup server 300 via thecommunication path 90.

As described above, the user 1 can make backup using the relay devicesthat relays the data via the communication path 20, the communicationpath 30 and the communication path 90.

<Structure>

Next, the functional structure of each of the information terminaldevice, the relay devices and the backup device included in the backupsystem 1000 is explained. As described above, it is assumed that theinformation terminal is the mobile phone 100. Also, it is assumed thatthe relay devices are the mobile phone 200, the backup server 300 and soon, and the backup device is the backup server 900.

<Information Terminal Device>

FIG. 2 is a functional block diagram of the mobile phone 100.

As FIG. 2 shows, the mobile phone 100 as an information terminal deviceincludes an image acquiring unit 11, a storing unit 12, a backup imageselecting unit 13, a transfer condition setting unit 14, a backupinformation generating unit 15, a transfer destination selecting unit16, a transfer destination authenticating unit 17, and a transmittingunit 18. Each of the components above is structured from, for example, acontrol circuit including a CPU (Central Processing Unit), a ROM (ReadOnly Memory), a RAM (Random Access Memory) and so on, and atransmission/reception circuit for transmitting and receiving data. Thebackup is performed by the components in accordance with a computerprogram. The following describes the function of each component.

The image acquiring unit 11 is a camera module or the like that realizesthe camera function of the mobile phone 100, and acquires data such asstill images and moving pictures.

The storing unit 12 stores the data acquired by the image acquiring unit11 using a storage medium such as a memory and a HDD (Hard Disk Drive).

The backup image selecting unit 13 selects, from pieces of the datastored in the storing unit 12, apiece of data to be transferred by therelay devices and backed up.

The transfer condition setting unit 14 sets up transfer conditioninformation, which is explained in a later section.

The backup information generating unit 15 adds the transfer conditioninformation and so on to transfer data, that is, data selected by thebackup image selecting unit 13, to generate data to be transmitted.

The transfer destination selecting unit 16 selects a transferdestination with which the mobile phone 100 can connect and communicatevia a communication path.

The transfer destination authenticating unit 17 authenticates a deviceat a transfer destination to which the data is transferred.

The transmitting unit 18 transmits the data to the device at thetransfer destination.

<Relay Device>

Next, the functional structure of the relay device is explained.

FIG. 3 is a functional block diagram of the mobile phone 200.

As FIG. 3 shows, the mobile phone 200 includes a transmission sourceauthenticating unit 21, a receiving unit 22, a storing unit 23, acontrol unit 24, a transfer destination selecting unit 25, a transferdestination authenticating unit 26, and a transmitting unit 27. Each ofthe components above is structured from, for example, a control circuitincluding a CPU (Central Processing Unit), a ROM (Read Only Memory), aRAM (Random Access Memory) and so on, and a transmission/receptioncircuit for transmitting and receiving data. The transfer of data toanother device via the relay device is performed by the components inaccordance with a computer program. The following describes the functionof each component.

The transmission source authenticating unit 21 authenticates a device ata transmission source of data at the other end, at reception of thedata.

The receiving unit 22 receives data via a communication path.

The storing unit 23 stores received data in a memory, HDD, or the like.

The control unit 24 controls transmission of data to a transferdestination device.

The transfer destination selecting unit 25 selects a transferdestination with which the mobile phone 200 can directly connect andcommunicate via a communication path.

The transfer destination authenticating unit 26 authenticates a deviceat a transfer destination to which data is transferred. Note that anymethod may be used for the authentication between devices. In thisembodiment, a well-known method such as challenge-responseauthentication is used. This is same as to the other devices.

The transmitting unit 27 transmits data to a device at a transferdestination.

FIG. 4 is a functional block diagram of the backup server 300. Thebackup server 300 has almost the same structure as the mobile phone 200.

As FIG. 4 shows, the backup server 300 includes a transmission sourceauthenticating unit 31, a receiving unit 32, a storing unit 33, acontrol unit 34, a transfer destination selecting unit 35, a transferdestination authenticating unit 36, and a transmitting unit 37.

Each of the components above achieves the function of the correspondingcomponent of the mobile phone 200. That is to say, the transmissionsource authenticating unit 31 authenticates, in the same manner as thetransmission source authenticating unit 21, a device at a transmissionsource of data at the other end, at reception of the data. Thetransmission source authenticating unit 31, the receiving unit 32, thestoring unit 33, the control unit 34, the transfer destination selectingunit 35, the transfer destination authenticating unit 36, and thetransmitting unit 37 have the same function as the transmission sourceauthenticating unit 21, the receiving unit 22, the storing unit 23, thecontrol unit 24, the transfer destination selecting unit 25, thetransfer destination authenticating unit 26, and the transmitting unit27 respectively. Therefore, the explanations thereof are omitted here.

<Backup Device>

Next, the functional structure of the backup device is explained.

FIG. 5 is a functional block diagram of the backup server 900.

As FIG. 5 shows, the backup server 900 includes a transmission sourceauthenticating unit 91, a receiving unit 92, a data extracting unit 93and a storing unit 94. Each of the components above is structured from,for example, a control circuit including a CPU, a ROM, a RAM and so on,a reception circuit for receiving data, and a large-capacity recordingmedium for storing and accumulating data. The reception of data,extraction of transfer data, and storage of the data is performed by thecomponents in accordance with a computer program.

The transmission source authenticating unit 91 authenticates, uponreception of data, a transmission source device as the party of thecommunication.

The receiving unit 92 receives data via a communication path.

The data extracting unit 93 extracts transfer data included in datareceived by the receiving unit 92.

The storing unit 94 stores transfer data extracted by the dataextracting unit 93.

<Data>

Next, the above-described transfer condition information is explained.

The transfer condition information is information indicating conditionsthat should be satisfied by the relay devices when relaying andtransferring data. The transfer condition information includes pieces ofinformation used for protection of the transfer data to be backed up. Inthis embodiment, the protection of the transfer data means protection ofprivacy relating to the transfer data.

The transfer condition information is transmitted with the transfer datawhen the information terminal device transmits the transfer data. Theinformation terminal device can limit the pathway to be used for therelay by performing the transfer in accordance with the transfercondition information. Note that the information terminal device alsotransmits predetermined information required for executing the backupvia the communication paths in addition to the transfer conditioninformation. The predetermined information includes, specifically,transfer data identifying information that identifies the transfer data,user identifying information that identifies an owner of the transferdata, address information indicating an address of the backup devicethat is a destination of the transfer data, and so on.

The following describes the transfer condition information in detail.

FIG. 6 is a table showing transfer condition information 600.

As FIG. 6 shows, the transfer condition information 600 includes atransfer deadline 61, a data keeping deadline 62, a deletion deadline63, an address notification necessity 64, a hop number 65, a reliabilitythreshold value 66 and a blacklist 67.

The transfer deadline 61 indicates a deadline for transferring transferdata to the backup device. In FIG. 6, for example, the transfer deadline61 indicates that the transfer data is to be transferred to the backupdevice before Jan. 1, 2005.

The data keeping deadline 62 indicates at least until when the relaydevice that relays the transfer data should keep the transfer data.After the data keeping deadline, the relay device may delete thetransfer data. If the deadline is set with use of the data keepingdeadline 62, it becomes unnecessary for the relay device to endlesslykeep the transfer data which will not be collected. As a result, itbecomes possible to effectively use a storage area included in the relaydevice. In FIG. 6, for example, the data keeping deadline 62 indicatesthat the transfer data should be kept by the relay device until Mar. 1,2005.

The deletion deadline 63 indicates a deadline at which transfer data asa relay target should be deleted from each storing unit of the relaydevice. With use of the deletion deadline 63, it becomes possible tomake it mandatory for the relay device to delete transfer data at thedead line indicated by the deletion deadline 63. As a result, if theuser of the information terminal device fails to collect the data to bebacked up, the risk of a violation of privacy due to the transfer dataunnecessarily remained in the relay device is reduced. In FIG. 6, forexample, the deletion deadline 63 is “not designated”, which means thatthe relay device is not required to delete transfer data.

The address notification necessity 64 indicates whether it is necessaryto notify the information terminal device that has transmitted thetransfer data of an address of the relay device that has received thetransfer data. If the user of the information terminal device that hastransmitted the transfer data is notified of the address by the relaydevice, the information terminal device can grasp which relay devicekeeps the transfer data. As a result, even in the case of losing theinformation terminal device, the user can collect the data to be backedup by inquiring the relay device at the notified address. In FIG. 6, forexample, the address notification necessity 64 indicates “necessary”.Therefore, upon receiving the transfer data, the relay device notifiesthe information terminal device of the address of the relay deviceitself. If the address notification necessity 64 does not indicate“necessary”, the relay device is not required to notify the informationterminal device of the address.

The hop number 65 indicates the number of relay devices that arepermitted to relay the transfer data before the transfer data reaches atthe backup device. In other words, the hop number 65 indicates the upperlimit of the number of transfers. With use of the hop number 65, it ispossible to prevent data transmission using an unnecessarily long relaypathway. This reduces the risk of leakage of transfer data to anextraneous user. In FIG. 6, for example, the hop number 65 indicates“3”, which means that the upper limit of the number of transfers isthree times.

The reliability threshold value 66 is information indicating the lowerlimit of a reliability level of a transfer destination device to whichtransfer of the transfer data is permitted. Here, the reliability levelof a transfer destination indicates how reliable the device is. In thisembodiment, the reliability level is digitized. For example, thereliability level of a device that is entirely reliable is 100, thereliability level of a device that is not reliable at all is 0, and areliability level of a device that is not reliable very much is 20.Note, in this embodiment, that the maximum value of the reliabilitylevel is 100, and the minimum value of the reliability level is 0. Ahigh reliability level represents high reliability. The relay devicestores values of the reliability level respectively in association withtransfer destination devices. For example, the relay device stores areliability threshold value table 700 as shown in FIG. 7.

The reliability threshold value table 700 is described next. Thereliability threshold value table 700 includes a transfer destinationdevice name 71, a transfer destination device address 72 and areliability level 73.

The transfer destination device name 71 indicates the name of the devicethat is a destination of the transfer.

The transfer destination device address 72 indicates an address of thetransfer destination device.

The reliability level 73 indicates a reliability level of the transferdestination device.

The relay device refers to the value indicated by the reliabilitythreshold value 66 included in the transfer condition information 600shown in FIG. 6, to control the transfer. In the example of FIG. 6, thereliability threshold value 66 indicates a value “80”. This means thatonly devices whose reliability level is not less than 80 are permittedto be a transfer destination.

Note that the value of the reliability level stored in each relay devicemay be predetermined by the user, or set by the relay device based on ahistory of communications with the transfer destination device. Thehistory is, specifically, the number of transfers of transfer data tothe transfer destination device, a history of data transmission andreception, and soon. Furthermore, the relay device may acquire the valueof the reliability level from another device. Also, as to thereliability level of the transfer destination device not stored by therelay device, the relay device may calculate the reliability level basedon the reliability level of each device on a pathway of the data to thetransfer destination device.

The blacklist 67 is information indicating devices that are notpermitted to be the transfer destination. Specifically, the blacklist 67indicates names and addresses of such devices. With use of the blacklist67, it becomes possible to avoid that the transfer data is transferredto a device that is not desired, by the information terminal device, tobe a transfer destination. In the example shown in FIG. 6, the blacklist67 indicates that the transfer data is not permitted to be transferredto a device “Musashi005” and so on.

<Operations>

Operations performed by the information terminal device, the relaydevice and the backup device are described next. As described in theOverview, it is assumed that the information terminal device is themobile phone 100, the relay devices are the mobile phone 200 and thebackup server 300, and the backup device is the backup server 900.

<Operations of Information Terminal Device>

FIG. 8 is a flowchart showing operations performed by the mobile phone100 as the information terminal device.

Using the backup image selecting unit 13, the mobile phone 100 selects apiece of data to be backed up from pieces of data that have beenacquired by the image acquiring unit 11 and stored in the storing unit12 (Step. S81). Here, the data to be backed up may be designated by theuser.

Using the transfer condition setting unit 14, the mobile phone 100 setsthe transfer condition information for the selected data to be backed up(Step S82). The transfer condition may be manually set by the user, orautomatically set by the mobile phone 100 in accordance with informationrelating to the data, such as the date when the data is acquired.

Upon the setting of the transfer condition by the transfer conditionsetting unit 14, the mobile phone 100 generates, using the backupinformation generating unit 15, data to be transferred to the relaydevice, based on predetermined information, such as a transmissionsource address, an address of the backup device that is the finaldestination and information identifying the data to be backed up, andthe transferred data to be backed up, and the transferred conditioninformation (Step S83).

After the generation of the data, the transfer destination selectingunit 16 selects a transfer destination with which the mobile phone 100can directly connect and communicate via a communication path. In thisembodiment, it is assumed that the mobile phone 100 selects the mobilephone 200. Upon selecting the mobile phone 200, the mobile phone 100authenticates the mobile phone 200, using the transfer destinationauthenticating unit 17. If the mobile phone 100 succeeds in mutualauthentication with the mobile phone 200, the mobile phone 100 transmitsthe data generated by the backup information generating unit 15 to themobile phone 200, using the transmitting unit 18, via the communicationpath 20 (Step S84).

<Operations of Relay Device>

FIG. 9 is a flowchart showing operations performed by each relay device,such as the mobile phone 200. The following explains specific operationsof mobile phone 200 as well as general operations performed by the relaydevice.

For receiving data, the relay device authenticates the transmissionsource device, using the transmission source authenticating unit 21.

If the relay device succeeds in the mutual authentication with thetransmission source device, the relay device receives the datatransmitted by the transmission source device via the communicationpath, using the receiving unit 22. The received data includes thetransfer condition information and the transfer data (Step S91).

The transfer data included in the data received from the transmissionsource device is stored in the storing unit 23 (Step S92).

When the transfer data is stored, the control unit 24 controls thetransfer of the transfer data in accordance with the transfer conditioninformation. Specifically, if there is any transfer destination devicethat satisfies the transfer condition information among the devices thatthe mobile phone 200 can communicate with, the control unit 24 selects atransfer destination device to which the data is transferred, using thetransfer destination selecting unit 25 (Step S93). If not, the controlunit 24 does not select any transfer destination device. In the casewhere the mobile phone 200 can directly communicate with the backupdevice at a relatively high speed, e.g. more than a predeterminedtransfer rate, the control unit 24 selects the backup device as thetransfer destination device.

Using the transfer condition information 600 shown in FIG. 6, thefollowing specifically describes the operations performed by the controlunit 24 to control the transfer of the transfer data based on thetransfer condition information. Firstly, transfer control using the hopnumber 65 is described. If the value indicated by the hop number 65 isgreater than “1”, the control unit 24 selects a transfer destinationdevice, decrements the hop number by one, and performs the transfer. Ifthe hop number 65 is not greater than “1”, the control unit 24 does notperform the transfer. In the example shown in FIG. 1, the mobile phone100 as the information terminal device firstly sets a value “3” to thehop number 65. Then, the mobile phone 200 as the relay device decrementsthe hop number 65 by one so as to be “2”, and performs the transfer.Further, the backup server 300 that has received the transfer data whosehop number is “2” confirms that the hop number is greater than “1”, andthen decrements the hop number by one so as to be “1”, and transfers thedata to the backup server 900.

In the case of selecting a transfer destination device using thereliability threshold value 66, the control unit 24 refers to thereliability threshold value table 700 for example, and selects atransfer destination device whose reliability level 73 is higher thanthe reliability threshold value 66 included in the transfer conditioninformation. At such a selection of a transfer destination device, therelay device may acquire a reliability level of another device fromoutside and select the transfer destination device based on the acquiredlevel. Also, various different methods may be used alternatively. In thecase where the value indicated by the reliability threshold value 66 isgreater than the predetermined value and a high reliability is demandedof the transfer destination device, the control unit 24 may permit onlydevices shown in a list of reliable transfer destination devicesprestored in the relay device or only devices shown in a list stored ina highly reliable transfer destination device to transfer the transferdata.

Further more, in addition to the determination as to whether to permitthe transfer, the transfer data may be converted based on thereliability level of each transfer destination device. For example, apredetermined code for tracking the transfer data may be added to thetransfer data if the data is to be transferred to a device whosereliability level is smaller than the value indicated by the reliabilitythreshold value 66. The predetermined code is used for finding a devicefrom which the transfer data has been leaked in the case of unauthorizeduse of the transfer data. For addition of the predetermined code,techniques such as finger printing and digital watermarking may be used.As other processing, if the transfer data is image data, the data sizemay be reduced by changing the image size. Or else, a filteringprocedure such as mosaic processing may be performed on a particularpart of the image, or the image may be deleted.

In the case where a device that is not permitted to be a transferdestination is included in the black list 67, the control unit 24performs control not to select the device, and not to transfer thetransfer data to the device.

Again, with reference to FIG. 9, the following further describes therelay device.

Upon selecting the transfer destination device, the relay devicecontrols the transfer of the data based on the result of the selection.In other words, if there is a transfer destination device that satisfiesthe transfer condition information, the relay device authenticates theselected transfer destination device using the transfer destinationauthenticating unit 26. If the relay device succeeds in the mutualauthentication with the transfer destination device, the relay devicetransfers the transfer data and the transfer condition information tothe transfer destination device via the communication path, using thetransmitting unit 27. If there is no transfer destination device thatsatisfies the transfer condition information, the relay device does nottransfer the transfer data (Step S94).

If the address notification necessity 64 included in the receivedtransfer condition information indicates “necessary”, the relay devicetransmits, when receiving the transfer data, the predetermined data thatindicates that the transfer data has been received to the address of theinformation terminal device at the transmission source, or to theaddress of the backup device as the transfer destination of the data.The predetermined data includes the address of the relay device that hasreceived the transfer data. If the predetermined data is transferred tothe address of the backup device, even in the case where the user losesthe information terminal device, the user can collect the data to bebacked up by inquiring the relay device at the address received by thebackup device.

The relay device also controls transfer and storage of transfer data inaccordance with each of the transfer deadline 61, the data keepingdeadline 62 and the deletion deadline 63, which are indicated by thetransfer condition information. Also, each relay device may confirmintegrity of the transfer data before storing the received data. Toconfirm the integrity, the relay device may use a well-known technique.For example, the relay device may add electronic signature to thetransfer data and verify the signature. Since the electronic signatureis a well-known technique, the explanation thereof is omitted here.

The operations performed by the relay device are described above. Thefollowing more specifically explains the operations by taking the mobilephone 200 as an example.

To receive data transmitted by the mobile phone 100, the mobile phone200 authenticates the mobile phone 100 as the transmission source, usingthe transmission source authenticating unit 21.

If the mutual authentication with the mobile phone 100 succeeds, themobile phone 200 receives the data transmitted by the mobile phone 100via the communication path 20, using the receiving unit 22 (Step S91).

The transfer data included in the data received by the mobile phone 200is stored by the storing unit 23 (Step S92).

Here, in this embodiment, it is assumed that a user 2 who is an owner ofthe mobile phone 200 connects the mobile phone 200 to the backup server200 also owned by the user 2. The communications between the backupserver 300 and the mobile phone 200 are realized by the techniquesdiscloses by Patent Documents 1 and 2 for example, by which thecommunications with the backup server 300 begin when the mobile phone200 is connected to the battery charger. And here, it is assumed thatthe backup server 300 satisfies the transfer condition information. Inthe example of this embodiment, the control unit 24, selects the backupserver 300 as the transfer destination device that satisfies thetransfer condition information, in accordance with the transfercondition information (Step S93).

Upon selecting the backup server 300 to be the transfer destinationdevice, the control unit 24 authenticates the backup server 300 usingthe transmission authenticating unit 26. If the mutual authenticationwith the backup server 300 succeeds, the control unit 24 transmits thetransfer data and the transfer condition information to the backupserver 300 via the communication path 30, using the transmitting unit 27(Step S94).

Note that the backup server 300 is capable of communicating with thebackup server 900, into which the data is backed up by the user 1 as theowner of the mobile phone 100, via the communication path 90. Therefore,in Step S93, the control unit 24 selects the backup server 900 as thetransfer destination device, and in Step S94, transfers the data to thebackup server 900.

<Operations of Backup Device>

The following describes operations performed by the backup device.

FIG. 10 is a flowchart showing operations performed by the backup server900 as the backup device.

For receiving data, the backup server 900 authenticates the transmissionsource device, using the transmission source authenticating unit 91. Ifthe mutual authentication with the transmission source device succeeds,the backup server 900 receives the data via the communication path,using the receiving unit 92 (Step S101).

The backup server extracts transfer data from the received data, usingthe data extracting unit 93 (Step S102).

Upon extracting the transfer data, the backup server 900 stores theextracted data in the storing unit 94 (Step S103).

<Applications>

In this example, the data of the information terminal device istransferred to the backup device. However, the present invention is notlimited to this embodiment, and various applications are possible.

In the example above, only one pathway via the communication path 20,the communication path 30, and the communication path 90 is described asthe pathway for the backup. However, in addition to this pathway,another pathway via the communication path 21, the communication path 31and the communication path 91 shown in the same drawing may be used forthe backup via the mobile phone 201 and the backup server 301. By usinga plurality of pathways to back up the data by the aid of the relaydevices, it becomes possible to more certainly transmit the data to thebackup device. For example, if identical copies of the data aretransmitted via a plurality of paths at the same time, even if thecollection of the data fails as to any of the paths, it is possible tocollect the data from the rest of the paths. Therefore, the backup ofthe data can be more surely performed.

To more surely realize the privacy protection, it is preferable that thetransfer data is transferred via a communication path that ispredictable by the information terminal device. As a result, it becomespossible to reduce the risk of leakage of the transfer data to acommunication path that is unknown to the user of the informationterminal device. For this reason, the transfer destinationauthenticating unit of each of the information terminal device and therelay device may select at least one from previously-registered transferdestinations. Or, reliability levels may be set for each device andstored previously, and a device with the highest reliability level maybe selected by priority among devices satisfying the transfer conditioninformation.

Also, regarding a relay device that directly communicates with theinformation terminal device and receives data the first, the conditionsindicated by the transfer condition information may not be applied. Thisis because, in the case where the information terminal device directlycommunicates with the relay device, the information terminal devicealready recognizes which devices is the transfer destination device, andthe user of the information terminal device does not suffer disadvantagerelating to privacy protection. Here, “not applying the transfercondition information” means, specifically, that the informationterminal device ignores the blacklist 67 and the reliability thresholdvalue 66, and transmits the data. In addition to this, various cases canbe assumed. For example, the hop number 65 may not be decreased. Also,the address may not be notified even if the address notificationnecessity indicates “necessary”.

Also, it can be assumed that the privacy is different for each piece ofthe transfer data. For example, image data including an image of aperson has a high value especially for the person as the object.Therefore, the information terminal device and the relay devices maychoose a different pathway for each piece of the transfer data. Forexample, to transfer a certain piece of data by the aid of usersparticularly relating to the data, the data is transferred by the mobilephone 200 and the backup server 300 via the communication path 20, thecommunication path 30, and the communication path 90. On the other hand,another piece of data is transferred by the mobile phone 201 and thebackup server 301 via the communication path 21, the communication path31 and the communication path 91, instead of the pathway including thecommunication path 20 and so on.

To strengthen the privacy protection, one piece of a transfer data maybe divided into more than two pieces, and each piece of data may betransferred via a different pathway. The backup device can combine thepieces of data each received via the different pathway, to obtain theoriginal data to be backed up. In this way, dividing the original datacan prevent that the original data is restored using the pieces of data.As a method for dividing data into more than two pieces, the ThresholdSecret Sharing Scheme may be used, for example. If this method is used,even if some of the pieces of data are lost in the course of thetransfer, it is possible for the backup device to restore the originaldata as long as the number of existing pieces of data is more than thethreshold value relating to the secret sharing.

Meanwhile, as a method for selecting a piece of data to be backed up, inaddition to the example described in the explanation of the operationsperformed by the information terminal device, the data to be backed upmay be selected in such a manner that only data generated after thepreviously-performed backup is selected. Also, if the data to be backedup is images, it is possible to select, by priority, an image includinga person as an object. Furthermore, it is possible to add an executionpriority to each piece of data stored in the storing unit 12 of theinformation terminal device, and the pieces of data are selected in theorder of the execution priority level by the backup image selecting unit13. Also, the priority may be determined based on various types ofinformation, such as necessity of the backup, importance of the data,whether the data has been already backed up or not, and the time lengthelapsed from the backup performed the last time. For example, a piece ofdata that has not ever been backed up may be given a priority over apiece of data that has been backed up recently.

The backup image selecting unit 13 can select, as data to be backed up,not only the data acquired by the image acquiring unit 11 and stored inthe storing unit 12, but also every piece of data acquired by the mobilephone 100. For example, it may be data acquired via a network or mediumsuch as a recording medium, or music data or movie data, or a commercialcontent distributed by a content provider and acquired by the mobilephone 100. In the above-described embodiment, since an example ofbacking up data acquired by the user is explained, the transfercondition information is explained as including information forprotecting privacy relating to the transfer data. However, in the caseof backing up a commercial content, the transfer condition informationindicates conditions to be satisfied for execution of the transfer, andit may be determined by the content provider. Note that the object ofthe present invention might not be the backup of the data. In otherwords, the object may be to simply transfer data to another device bythe aid of the relay devices that relays the data.

Also, in the above-described embodiment, the relay device judges whetherto delete the transfer data in accordance with each of the transferdeadline 61, the data keeping deadline 62 and the deletion deadline 63.However, the present invention is not limited to this. The relay devicemay delete the transfer data stored therein when receiving apredetermined signal from another device such as the backup device. Sucha signal may be transmitted from said another device when said anotherdevice stores the transfer data. This enables the relay device toconfirm that the relay device can delete the transfer data. Therefore,it becomes unnecessary for the relay device to endlessly keep thetransfer data.

In the above described embodiment, when the information terminal devicebegins the backup is not particularly limited. The backup may be startedat a user's instruction, or may be performed periodically. Also, theexecution of the backup may be automatically prepared when apredetermined time elapses from the time when the backup was performedthe last time, and then performed immediately after a transferdestination device is found. Furthermore, a predetermined condition maytrigger the preparation for execution of the backup. For example, thepreparation may start when the user passes through the gate of hishouse, or when an amount of data that has not been backed up reaches apredetermined amount.

In addition to the above-described embodiment, to ensure the privacyprotection, the information terminal device and the relay device mayencrypt the data to be backed up before starting the transmission, toreduce the risk that the data is referred from outside. This encryptionmay be performed every time the transfer is performed, and may beperformed using a public key of the backup device. Also, signature dataor authentication code (Message Authentication Code) may be added to thedata at the time of the transmission. It is possible to use public keycryptography for this signature as well. As a result, it becomespossible to confirm that the data in the backup device is not tamperedor counterfeited.

The relay device may transfer received data to another device withoutchange, or may change codec, if the data is image data or moving picturedata, or perform compensation, or change the size or the bit rate beforetransferring the data. Also, the relay device may add a digitalwatermark or information for tracking the data to the data beforetransferring the data.

Note that a term “backup” generally means to transmit a copy of the datato be backed up to the backup device with keeping the original data inthe information terminal device. However, regarding the presentinvention, the information terminal device may delete the data to bebacked up stored in the storing unit 12 after transmitting the data. Asa result, even in the case where the remaining capacity of the storagearea is small, it is possible to make space for storing data.

Second Embodiment

The following describes another embodiment of the backup systemaccording to the present invention, with reference to the drawings.

<Overview>

FIG. 11 shows an overall structure of a backup system 2000 according tothe second embodiment of the present invention. The second embodiment isdifferent from the first embodiment in that the relay devices such as amobile phone 210 and a mobile phone 211, having substantially the samestructure as the mobile phone 200 and the mobile phone 201, do nottransfer data when receiving the data from the mobile phone 100 as theinformation terminal device, and instead, transmits exchange informationindicating which relay device stores the transfer data to a backupserver 900 as the backup device via a communication path 50 and acommunication path 51. The mobile phone 210 and the mobile phone 211 areconnected to the backup server 900 via the communication path 50 and thecommunication path 51 respectively. Here, it is assumed that thecommunication path 50 and the communication path 51 are telephone linesfor example, and their communication speeds are lower than that of thebroadband network.

As a result, even if the user of the information terminal device loosesthe information terminal device, it is possible to collect the backupdata by specifying the relay device that stores the backup data based onthe exchange information received by the backup device, and having therelay device transfer the data.

The following mainly describes the differences from the firstembodiment.

<Structure>

The structure of the information terminal device is the same as thefirst embodiment. Therefore, an explanation thereof is omitted here, andthe structure of the relay device is described next.

FIG. 12 is a functional block diagram of a mobile phone 210 according tothe second embodiment.

As FIG. 12 shows, the mobile phone 210 includes an exchange informationcreating unit 28, which is not included in the mobile phone 200 of thefirst embodiment. The components other than the exchange informationcreating unit 28 are the same as the components of the mobile phone 200.Therefore, the same reference numbers are given to those components, andexplanations thereof are omitted here.

When the data transmitted from the information terminal device isreceived by the receiving unit 22 and stored in the storing unit 23, theexchange information creating unit 28 creates the exchange informationindicating which relay device stores the transfer data. The exchangeinformation is described later. The exchange, information creating unit28 transmits the created exchange information to the backup device whichis the final transfer destination of the received data.

The structure of the mobile phone 211 is the same as the mobile phone210. Therefore, an explanation thereof is omitted here.

The backup server 900 as the backup device receives, using the receivingunit 92, the exchange information transmitted by the mobile phone 210via a communication path, and stores the received exchange informationin the storing unit 94.

<Data>

The following describes the exchange information.

FIG. 13 shows exchange information 1300. Note that FIG. 13 shows anexample of the exchange information to be transmitted by the mobilephone 210 as the relay device to the backup server 900 in the case wherethe data to be backed up is transmitted by the mobile phone 100 to themobile phone 210.

As FIG. 13 shows, the exchange information 1300 includes backup sourceidentifying information 131, keeping device identifying information 132,a backup data ID 133, a backup data amount 134, a keeping period 135,and a signature 136.

The backup source identifying information 131 includes an ID ofinformation terminal device that performs the backup, and an address ofthe information terminal device. In the sample shown in FIG. 13, thebackup source identifying information 131 indicates that the ID of theinformation terminal device is “Hanako001” and the address of theinformation terminal device is “123.456.789.001”.

The keeping device identifying information 132 indicates an ID of therelay device that has received the data from the information terminaldevice and stores the data, and the address of the relay device. In theexample shown in FIG. 13, the keeping device identifying information 132indicates that the ID of the relay device is “Musashi005” and theaddress of the relay device is “456.789.012.345”.

The backup data ID 133 is information for identifying data backed up bythe information terminal device, and indicates the name of the data. Inthe example shown in FIG. 13, the backup data ID 133 indicates twonames, namely “Photo1.jpg” and “Photo2.jpg”, as data names.

The backup data amount 134 indicates the data amount of the data backedup by the information terminal device. In the example shown in FIG. 13,the data amount is “5 MB”.

The keeping period 135 indicates a period for which the relay devicekeeps the data to be backed up. In the example shown in FIG. 13, therelay device keeps the data for four months from Nov. 1, 2004 to Mar. 1,2005.

The signature 136 indicates that the exchange information 1300 has beencreated by the relay device that stores the data. The signature isgenerated by an RSA signature-method and so on, using the private key ofthe relay device.

<Operations>

The following describes operations performed by each relay device.Operations performed by the information terminal device are the same asthose of the first embodiment. Therefore, an explanation thereof isomitted here.

FIG. 14 is a flowchart showing operations performed by the relay deviceaccording to the second embodiment. In the example of FIG. 14, the casewhere the relay device is the mobile phone 210 is explained. Note thatthe backup device is the backup server 900.

Step S141 is for the same processing as Step S91 shown in FIG. 9, andStep S142 is for the same processing as Step S92. Therefore,explanations thereof are omitted here.

When the transfer data is stored in the storing unit 23 by theprocessing in Step S142, the exchange information creating unit 28creates exchange information, and transmits the created exchangeinformation to the backup server 900 via a communication path 50 (StepS143).

After transmitting the exchange information, if the relay devicereceives an inquiry as to the transfer data from the backup server 900,the relay device starts transfer of the transfer data to the backupserver 900 (Step S144). If the relay device does not receives an inquireas to the transfer data from other devices such as the backup server900, the relay device keeps or deletes the transfer data stored in thestoring unit 23, in accordance with the period shown by the keepingperiod 135.

Note that the size of the exchange information is smaller than imagedata and so on. Therefore, even if the exchange information istransmitted to the backup server 900 via a low-speed communications linesuch as the communication path 50, load on the line and the cost is low.

Meanwhile, upon receiving the exchange information via the communicationpath 50, the backup server 900 stores the received exchange informationin the storing unit 94.

If the user of the information terminal device that backs up the data inthe backup server 900 loses the information terminal device, the userrequests the relay device that stores the transfer data to transfer thetransfer data based on the exchange information stored in the backupserver 900, and collects the data. The method used for collecting thedata is, for example, a method using an IP address for using a network,or a method using a medium such as a memory card.

In the second embodiment above, the relay device transmits the createdexchange information to the backup device. However, the presentinvention is not limited to this. The relay device may transmit theexchange information to a device other than the backup device, such asthe information terminal device. If this is the case, the user of theinformation terminal device may keep the received exchange informationin a removable medium or the like. This means that the user can keep thesubstation information separately from the information terminal device.Also, the exchange information may be transmitted from the informationterminal device to the backup device.

Third Embodiment

The following describes a backup system according to the thirdembodiment.

<Overview>

The third embodiment is characterized by that when a mobile phonetransmits data to be backed up to another device, the mobile phone alsoreceives data to be backed up from the transfer destination device.

Here, the both devices transmit and receive transmission/receptioncondition information to and from each other, and judge whether toperform mutual backup based on the transmission/reception conditioninformation.

With this structure, it is possible to prevent that only one of thedevices occupies the storage of the other device to back up data, andthe devices can perform mutual backup under a fair condition. Thefollowing describes, as an example, a case where mobile phones performsuch mutual backup.

<Structure>

FIG. 15 is a functional block diagram of a mobile phone 500 which has afunction of performing mutual backup. In this embodiment, it is assumedthat the mobile phone 500 and a mobile phone having the same structureas the mobile phone 500 perform the mutual backup.

As FIG. 15 shows, the mobile phone 500 includes an image acquiring unit11, a storing unit 12, a backup image selecting unit 13, a transfercondition information setting unit 14, a backup information generatingunit 15, a transmitting unit 18, a transmission source/destinationselecting unit 51, a transmission source/destination authenticating unit52, a receiving unit 53, a transmission/reception condition control unit54, and a transmission/reception condition generating unit 55.

The image acquiring unit 11, the storing unit 12, the backup imageselecting unit 13, the transfer condition information setting unit 14,and the backup information generating unit 15 are the same as those ofthe mobile phone 100 in the first embodiment. Therefore, explanationsthereof are omitted here.

The transmitting unit 18 has a function of transmitting data. Forexample, the transmitting unit 18 transmits data to be backed up;transmission/reception condition information that relates to the data tobe backed up by the mobile phone 500 itself, and so on. The transmissionsource/destination selecting unit 51 selects a mobile phone thatperforms the mutual backup.

The transmission source/destination authenticating unit 52 authenticatesa mobile phone that performs the mutual backup.

The receiving unit 53 receives the data transmitted from the mobilephone as the party of the mutual backup, or the transmission/receptioncondition information transmitted from the party.

The transmission/reception control unit 54 controls the mutual backupwith the mobile phone as the party, based on the transmission/receptioncondition information that relates to the data that is to be backed upby the mobile phone 500 itself and the transmission/reception conditioninformation that is transmitted from the mobile phone as the party ofthe mutual backup.

The transmission/reception condition generating unit 55 generates thetransmission/reception condition information that relates to the data tobe backed up by the mobile phone 500 itself.

<Data>

The following describes the transmission/reception conditioninformation.

FIG. 16 shows the transmission/reception condition information. In theexample of FIG. 16, a transmission condition 1600 a representstransmission/condition information that relates to data to be backed upby the mobile phone 500 itself. A reception condition 1600 b representsinformation that relates to the data to be backed up by the party of themutual backup. In this embodiment, whether to execute the mutual backupis judged based on the transmission/reception condition informationtransmitted by the mobile phone 500 itself and thetransmission/reception condition information received from the party ofthe mutual backup.

As FIG. 16 shows, a data amount 161 a included in the transmissioncondition 1600 a indicates an amount of data to be backed up by themobile phone 500 itself.

A recording method 162 a indicates how the data to be backed up by themobile phone 500 should be recorded by the mobile phone as the party. Inthe example shown in FIG. 16, “double recoding” means that the datashould be recorded at two locations.

A keeping deadline 163 a indicates a deadline until which the backupdata is desired to be kept. In the example shown in FIG. 16, the mobilephone as the party is desired to keep the data for four months untilMar. 1, 2005.

A data amount 161 b included in the reception condition 1600 b indicatesan amount of data to be backed up by the mobile phone as the party.

A recording method 162 b indicates how the data to be backed up by themobile phone as the party should be recorded by the mobile phone 500.

A keeping deadline 163 b indicates a deadline until which the backupdata to be backed up by the party is desired to be kept by the mobilephone 500. In the example shown in FIG. 16, the mobile phone 500 isdesired to keep the data for two months until Jan. 1, 2005.

<Operations>

FIG. 17 is a flowchart showing operations performed by the informationterminal device and another device for the mutual backup. The exampleshown in FIG. 17 describes the operations up to the exchange of thebackup data performed by the mobile phone 500 and the mobile phone asthe party. The operations for the transfer of the data to the backupdevice performed after the data is exchanged are the same as that of therelay device in the first embodiment. Therefore, the explanationsthereof are omitted here.

As shown in FIG. 17, the mobile phone 500 selects data to be backed up,using the backup image selecting unit 13 (Step S1701). Regarding theselected data, the mobile phone 500 sets the transfer condition, usingthe transfer condition setting unit 14, and generates data to betransmitted to another device, using backup information generating unit15 (Step S1702).

After generating data to be transmitted, the mobile phone 500 generatesthe transmission/reception condition information relating to the data tobe backed up (Step S1703). More specifically, the mobile phone 500generates the transmission condition 1600 a shown in FIG. 16. On theother hand, the mobile phone as the party generates the receptioncondition 1600 b shown in FIG. 16.

After both devices have generated the transmission/reception conditioninformation, the mobile phone 500 transmits the transmission condition1600 a using the transmitting unit 18, and receives the receptioncondition 1600 b using the receiving unit 53 (Step S1704).

After exchanging the transmission/reception conditions, thetransmission/reception condition control unit 54 digitizes thetransmission/reception condition, and judges whether thetransmission/reception conditions are fair to both phones (Step S1705).

As a method for the digitization, it is possible to digitize thecondition by calculating “required memory amount×period”. In the exampleof FIG. 16, according to the transmission condition 1600 a transmittedby the mobile phone 500, the value of the digitizedtransmission/reception condition is “5 MB×double recording×fourmonths=40”. On the other hand, according to the transmission condition1600 b received from the mobile phone as the party, the value of thedigitized transmission/reception condition is “20 MB×single recording×2months=40”. In this way, if the exchanged transmission/receptionconditions are digitized to the same value, the transmission/receptioncondition control unit 54 judges that the backup is fair (Step S1705:YES).

If judging that the backup is not fair, based on the digitizedtransmission/reception conditions (Step S1705: NO), thetransmission/reception control unit 54 controls thetransmission/reception of data so that the mutual backup becomes fair(Step S1706). For example, the size of the data to be backed up by themobile phone 500 is 10 MB, the value of the digitized transmissioncondition is “10 MB×double recording×4 months=80”. This is not equal tothe value calculated by digitizing the reception condition 1600 b.Therefore, the transmission/reception control unit 54 judges that thismutual backup is not fair. In this case, the transmission/receptioncontrol unit 54 sets 40 MB as the amount of data that the mobile phone500 receives from the mobile phone as the party. As a result, the valuecalculated by digitizing the transmission/reception conditioninformation of the mobile phone as the party is “40 MB×singlerecording×2 months=80”, which means that this transmission/receptioncondition is fair.

After the transmission/reception condition control unit 54 has finishedthe control, the mobile phone 500 exchanges the backup data with themobile phone as the party (Step S1707).

The above is the backup system according to the third embodiment.However, the present invention is not limited to this, and variousapplications are possible.

For example, in the above-described example, Step S1705 of FIG. 17 isexplained that the transmission/reception conditions exchanged betweenthe mobile phone 500 and the party are digitized, and if the values arethe same, the transmission/reception condition control unit 54 judgesthat the backup is fair. However, the transmission/reception conditioncontrol unit 54 may judge that the backup is fair not only in the casewhere the values are the same, but also the case where the differencebetween the values is less than a predetermined threshold value, or, forexample, the case where one of the values is not smaller than 70% andnot more than 130% of the other value, to relax the criterion for thejudgment.

Also, in the above-described embodiment, the mutual backup is startedwhen the transmission/reception conditions are regarded as being fair.However, even if the transmission/reception conditions are regarded asbeing fair, if the mobile phone as the party does not satisfy thecondition indicated by the transfer condition information, the mutualbackup may not be permitted. This prevents data exchange with anundesired party.

Also, in the example above, if the values calculated by digitizing thetransmission/reception conditions are not the same, the difference iscontrolled in Step S1706 such that the transmission/reception conditionsbecome fair, or if the difference is within a certain range, thecondition is regarded as being fair. However, the present invention isnot limited to this. For example, the difference may be converted to aright or a voucher that can be used for executing backup the next time.If this is the case, the right or the voucher may be used for mutualbackup not with the mobile phone as the party with which the right orthe voucher is generated.

Furthermore, the difference may be converted to valuable information oran incentive not relating to execution of the backup. For example, thedifference may be converted to value information having a cash value,such as electronic money and points. Also, it may be converted to aright to use processing power or calculation power of other devices, ora right to use a bandwidth broader than other devices, or a right toview a commercial content such as moving pictures.

In addition to the above-described embodiments, the present inventionalso includes a structure in which both devices store the data to bebacked up mutually without using the transfer condition information.

Also, in the explanation of Step S1703, regarding the method used by thetransmission/reception condition generating unit 55 to generate thetransmission/reception condition information, it is described that thetransmission/reception condition generating unit 55 generates thetransmission/reception condition information shown in FIG. 16. However,the transmission/reception condition information may be generated basedon a user's input, or automatically generated based on informationrelating to the data to be backed up, such as the data amount.

Also, the transmission/reception condition information may furtherinclude conditions relating to a recording medium that stores the backupdata, such as a reliability of a medium that stores the backup data, ora security level of a storage medium.

<Supplemental Description> (Other Modifications)

The present invention is described based on the embodiments above.However, the present invention is not limited to this. The following arepossible modifications.

(1) The above-described embodiments explain cases where the informationterminal device is a mobile phone. However, the present invention is notlimited to this. The information terminal device may be a communicationdevice having a communication function. The communication device is, forexample, a PDA (Personal Digital Assistance), a personal computer or apalm top.(2) Each of the above-described devices is specifically a computersystem structured from a microprocessor, a ROM, a RAM, a hard disk unit,a display unit, a keyboard, a mouse, and so on. A computer program isstored on the RAM or the hard disk unit. Each device carries outfunctions as a result of the microprocessor operating in accordance withthe computer program. Here, a computer program is structured by acombination of a plurality of instruction codes for instructing acomputer to achieve predetermined functions.(3) Part or all of the components structuring the information terminaldevice, the relay device, and the backup device may be a single systemLSI (Large Scale Integration). The system LSI is a super-multifunctionalLSI, which is manufactured by integrating a plurality of components on asignal chip, and specifically is a computer system structured by amicroprocessor, a ROM, a RAM and so on. A computer program is stored onthe RAM. The system LSI carries out functions as a result of themicroprocessor operating in accordance with the computer program. Eachsystem LSI may be separately realized as a single chip, or part or allof the System LSI may be realized as a single chip. Note that though LSIis used here, the circuit may be variously described as an IC, a systemIC, a super LSI or an ultra LSI depending on the level of integration.

Note also that the technique used to make an integrated circuit is notlimited to the LSI technique. A special-purpose circuit or ageneral-purpose processor may be used instead. It is also possible touse LSI circuits such as the programmable FPGA (Field Programmable GateArray) whose configurations can be altered after production or areconfigurable processor whose circuit cell connections and settings areconfigurable.

Moreover, if a technology to replace LSI emerges due to progress in thefield of semiconductor technology or due to the derivation of anothertechnology, such a technology may be used to integrate the functionalblock. The use of biotechnology, and the like is considered to be apossibility.

(4) The present invention may be the backup method described above.Also, the present invention may be a computer program for realizing themethod using computer, or digital codes of the computer program.

Further, the present invention may be the above-mentioned computerprogram and the digital code recorded onto a recording medium. Examplesof such recording media include, a flexible disk, a hard disk, a CD-ROM,a MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray Disc), a semiconductormemory and the like.

Further, the present invention may be realized such that the computerprogram and the digital code are transmitted across telecommunicationsnetworks, wired and wireless, such as the Internet and the like.

Further, the present invention may be a computer system having amicroprocessor and a memory, the memory holding the above-mentionedcomputer program and the microprocessor performing operations accordingto the computer program.

(5) The present invention may include various combinations of theembodiments and the modifications. INDUSTRIAL APPLICABILITY

The backup system according to the present invention is particularlyuseful for performing backup in an environment where mobilecommunication devices such as mobile phones are used.

1. A backup system that transfers data transmitted by an informationterminal device to a backup device via at least one relay device thatrelays the data, the information terminal device comprising: a storingunit operable to store the data to be backed up; and a communicationunit operable to transmit, to the relay device, the data and transfercondition information that indicates a condition to be satisfied by therelay device and relates to protection of the data, the relay devicecomprising: a device information storing unit operable to store deviceinformation relating to transfer destination devices; a receiving unitoperable to receive the data and the transfer condition information; anda transfer control unit operable to select, from the transferdestination devices, a transfer destination device that satisfies thecondition indicated by the received transfer condition information, andto control transfer of the received data in accordance with theselection, and the backup device comprising: a backup data receivingunit operable to receive the data transferred by the relay device; and abackup data storing unit operable to store the received data.
 2. A relaydevice that relays data transmitted by an information terminal device toa backup device, comprising: a device information storing unit thatstores device information relating to devices as candidates for atransfer destination of the data; a receiving unit operable to receivethe data and transfer condition information that indicates a conditionto be satisfied by the relay device and relates to protection of thedata; and a transfer control unit operable to select, from thecandidates, a device that satisfies the condition indicated by thereceived transfer condition information, and to control transfer of thereceived data in accordance with the selection.
 3. The relay device ofclaim 2, wherein the condition indicated by the transfer conditioninformation is that a device is not in a blacklist showing devices notpermitted to be the transfer destination, and the transfer control unitselects, from the candidates, a device that is not in the blacklist. 4.The relay device of claim 2, wherein the device information includes areliability level for each of the candidates, the transfer conditioninformation indicates a threshold value of the reliability level to besatisfied by the transfer destination, and the transfer control unitselects, from the candidates, a device that satisfies the thresholdvalue.
 5. The relay device of claim 2, wherein the transfer control unitfurther includes a conversion processing subunit operable to performpredetermined conversion processing on the data, and transfers the dataafter performing the predetermined conversion processing on the data. 6.The relay device of claim 5, wherein the transfer control unit controlsthe transfer such that the data converted by the conversion processingsubunit is transferred to a device not satisfying the conditionindicated by the transfer condition information.
 7. The relay device ofclaim 5, wherein the predetermined conversion processing performed bythe conversion processing subunit is insertion of an identifier of therelay device, as a digital watermark, into the data.
 8. The relay deviceof claim 2, wherein the receiving unit further receives at least one ofa transfer deadline, a data keep deadline and a deletion deadline, ifthe receiving unit receives the transfer deadline, the relay devicecontrols the transfer, using the transfer control unit, such that thedata is received by the backup device before the transfer deadline, ifthe receiving unit receives the data keeping deadline, the relay devicekeeps the data until the keeping deadline, and if the receiving unitreceives the deletion deadline, the transfer control unit deletes thedata at the deletion deadline.
 9. The relay device of claim 2 furthercomprising: an exchange information transmitting unit operable to createand transmit exchange information indicating that the data received bythe receiving unit is kept in the relay device; and a transfer requestreceiving unit operable to receive, from another device that hasreceived the exchange information, a request for transfer of the datacorresponding to the exchange information, wherein if the transferrequest receiving unit receives the transfer request, the transfercontrol unit controls the transfer such that the data relating to thetransfer request is transmitted to said another device.
 10. Aninformation terminal device that transmits data to a backup device viaat least one relay device that relays the data, the information terminaldevice comprising: a storing unit operable to store the data to bebacked up; and a communication unit operable to transmit, to the relaydevice, the data and transfer condition information that indicates acondition to be satisfied by the relay device and relates to protectionof the data.
 11. The information terminal device of claim 10, whereinthe storing unit further stores relay device information relating torelay devices as candidates for a transfer destination of the data, andthe communication unit selects, from the candidates, a device thatsatisfies the condition indicated by the condition information, andtransmits the data and the transfer condition information in accordancewith the selection.
 12. The information terminal device of claim 10,wherein before transmitting the data, the communication unit transmitsfirst transmission/reception condition information to a relay device,and receives second transmission/reception condition information fromthe relay device, and the information terminal device further comprisesa judging unit operable to judge whether the firsttransmission/reception condition information and the secondtransmission/reception condition information are substantially the same,and if the judging unit judges affirmatively, the communication unittransmits the data to the relay device.
 13. The information terminaldevice of claim 12, wherein the first transmission/reception conditioninformation is associated with transmission data that the informationterminal device transmits, the second transmission/reception conditioninformation is associated with reception data that the informationterminal device receives from the relay device, if the judging unitjudges affirmatively, the communication unit transmits the transmissiondata to the relay device and receives the reception data from the relaydevice, and the storing unit stores the received reception data.
 14. Theinformation terminal device of claim 12, wherein each of the firsttransmission/reception condition information and the secondtransmission/reception condition information includes at least one of asize of the data, a keeping deadline until which the relay device or theinformation terminal device keeps the data, a recording method forrecording the data in a recording medium and an incentive for keepingthe data.
 15. The information terminal device of claim 14, wherein theincentive includes at least one of value information having a cashvalue, relay device control information indicating a right to have therelay device perform predetermined processing, and viewing rightinformation indicating a right to view a predetermined content.
 16. Abackup device that receives data transmitted from an informationterminal device via the relay device of claim 9, the backup devicecomprising: an exchange information receiving unit operable to receivethe exchange information from another device; a transfer requesttransmitting unit operable to transmit a request for transferring thedata to the relay device that keeps the data; a backup data receivingunit operable to receive the data relating to the request; and a backupdata storing unit operable to store the received data.
 17. An integratedcircuit used for an information terminal device that transmits data to abackup device via at least one relay device that relays the data, theintegrated circuit comprising: a storing unit operable to store the datato be backed up; and a communication unit operable to transmit the dataand transfer condition information that indicates a condition to besatisfied by the relay device and relates to protection of the data. 18.A computer program for instructing an information terminal device thatstores data to be backed up to transmit the data to a backup device viaat least one relay device that relays the data, the computer programcomprising the step of transmitting the data and transfer conditioninformation that indicates a condition to be satisfied by the relaydevice and relates to protection of the data.
 19. A backup method fortransferring data transmitted by an information terminal device to abackup device via at least one relay device that relays the data, thebackup method comprising: the steps performed by the informationterminal device of storing the data to be backed up, and transmitting,to the relay device, the data and transfer condition information thatindicates a condition to be satisfied by the relay device and relates toprotection of the data; the steps performed by the relay device ofstoring device information relating to devices as candidates for atransfer destination of the data, receiving the data and transfer thecondition information, and selecting, from the candidates, a device thatsatisfies the condition indicated by the received transfer conditioninformation, and controlling the transfer of the received data inaccordance with the selection; and the steps performed by the backupdevice of receiving the data transferred by the relay device; andstoring the received data.
 20. A backup method for backing up data withuse of a first information terminal device and a second informationterminal device, the backup method comprising: a storing step of storingthe data to be backed up; and a communication step of transmitting thedata and transfer condition information that indicates a condition to besatisfied by the relay device and relates to protection of the data,wherein when performed by the first information terminal device, thecommunication step further transmits first transmission/receptioncondition information to the second information terminal device andreceives second transmission/reception condition information from thesecond information terminal device, before transmitting first data tothe second information terminal device, and when performed by the secondinformation terminal device, the communication step further transmitsthe second transmission/reception condition information to the firstinformation terminal device and receives the firsttransmission/reception condition information from the first informationterminal device, before transmitting the second data to the firstinformation terminal device, wherein the backup method further comprisesa judging step of judging whether the first transmission/receptioncondition information and the second transmission/reception conditioninformation are substantially the same, wherein when performed by thefirst information terminal device, the communication step furthertransmits the first data to the second information terminal device ifthe judging step judges affirmatively, and when performed by the secondinformation terminal device, the communication step further transmitsthe second data to the first information terminal device.